samba 已更新，修复了七个安全问题。

修复了这些安全问题：

- CVE-2015-5370：DCERPC 服务器和客户端容易遭受 DOS 和 MITM 攻击 (bsc#936862)。

- CVE-2016-2110：中间人可将 NTLMSSP 认证降级 (bsc#973031)。

- CVE-2016-2111：域控制器 netlogon 成员计算机可能遭到欺骗 (bsc#973032)。

- CVE-2016-2112：LDAP 连接容易遭受降级和 MITM 攻击 (bsc#973033)。

- CVE-2016-2113：TLS 证书验证缺失 (bsc#973034)。

- CVE-2016-2115：命名管道 IPC 容易遭受 MITM 攻击 (bsc#973036)。

- CVE-2016-2118：可能会发生经认证帐户的“Badlock”DCERPC 假冒 (bsc#971965)。

已修复下列非安全性问题：

- bsc#974629：移除现在过时无效的 tdb_close 调用，修复 samba.tests.messaging 测试并防止可能发生的 tdb 损坏。

- bsc#973832：从 samba-libs 中弃用 libsmbsharemodes0，并从 samba-core-devel 中弃用 libsmbsharemodes-devel。

- bsc#972197：不提供时从 libsmbclient0 中弃用 libsmbclient，并从 libsamba-passdb-devel 中弃用 libpdb-devel。

- 取得并设置符号链接的 Windows ACL，可更改链接的权限

- bsc#924519：将磁盘上的 FSRVP 服务器状态升级到新版本。

- bsc#968973：只弃用但不提供 gplv2/3 程序包名称。

- bso#6482：s3:utils/smbget：修复递归下载。

- bso#10489：s3：smbd：posix_acls：修复在没有 ACL 支持的情况下于文件系统中设置 u:g:o 条目的检查。

- bso#11643：docs：将域登录的范例添加至 smbspool 手册页。

- bso#11690：s3-client：为 smbspool 添加 KRB5 封装程序。

- bso#11708：loadparm：修复内存泄漏问题。

- bso#11714：lib/tsocket：解决不支持 FIONREAD 的套接字。

- bso#11719：ctdb-scripts：放弃使用“smbcontrol winbindd ip-dropped ...”。

- bso#11727：s3：smbd：open：创建新文件时跳过对 file_set_dosmode 的多余调用。

- bso#11732：param：修复 str_list_v3 以再次接受“;”。

- bso#11740：loadparm 中的实时内存泄漏（构建）问题。

请注意，Tenable Network Security 已直接从 SUSE 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

此更新修复了以下安全漏洞：

- CVE-2015-5370：DCERPC 服务器和客户端容易遭受 DOS 和 MITM 攻击 (bsc#936862)。

- CVE-2016-2110：中间人可将 NTLMSSP 认证降级 (bsc#973031)。

- CVE-2016-2111：域控制器 netlogon 成员计算机可能遭到欺骗 (bsc#973032)。

- CVE-2016-2112：LDAP 连接容易遭受降级和 MITM 攻击 (bsc#973033)。

- CVE-2016-2113：TLS 证书验证缺失 (bsc#973034)。

- CVE-2016-2114：未强制执行“server signing = mandatory”(bsc#973035)。

- CVE-2016-2115：命名管道 IPC 容易遭受 MITM 攻击 (bsc#973036)。

- CVE-2016-2118：可能会发生经认证帐户的“Badlock”DCERPC 假冒 (bsc#971965)。

由于上游不再支持 4.1.x 版本，因此 openSUSE 13.1 更新也升级到 samba 4.2.4。副作用是 libpdb0 程序包会被 libsamba-passdb0 替换。

The version of Samba on the remote host is 4.3.x prior to 4.3.7 and is affected by the following vulnerabilities :

 - A flaw exists in the DCE-RPC client when handling specially crafted DCE-RPC packets. A man-in-the-middle (MitM) attacker can exploit this to downgrade the connection security, cause a denial of service through resource exhaustion, or potentially execute arbitrary code. (CVE-2015-5370)
 - A flaw exists in the implementation of NTLMSSP authentication. A MitM attacker can exploit this to clear the NTLMSSP_NEGOTIATE_SIGN and NTLMSSP_NEGOTIATE_SEAL settings, take over the connections, cause traffic to be sent unencrypted, or have other unspecified impact. (CVE-2016-2110)
 - A flaw exists in NETLOGON due to a failure to properly establish a secure channel connection. A MitM attacker can exploit this to spoof the computer names of a secure channel's endpoints, potentially gaining session information. (CVE-2016-2111)
 - A flaw exists in the integrity protection mechanisms that allows a MitM attacker to downgrade a secure LDAP connection to an insecure version. (CVE-2016-2112)
 - A flaw exists due to improper validation of TLS certificates for the LDAP and HTTP protocols. A MitM attacker can exploit this, via a crafted certificate, to spoof a server, resulting in the disclosure or manipulation of the transmitted traffic. (CVE-2016-2113)
 - A flaw exists due to a failure to enforce the 'server signing = mandatory' option in smb.conf for clients using the SMB1 protocol. A MitM attacker can exploit this to conduct spoofing attacks. (CVE-2016-2114)
 - A flaw exists due to a failure to perform integrity checking for SMB client connections. A MitM attacker can exploit this to conduct spoofing attacks since the protection mechanisms for DCERPC communication sessions are inherited from the underlying SMB connection. (CVE-2016-2115)
  - A flaw, known as Badlock, exists in the Security Account Manager (SAM) and Local Security Authority (Domain Policy) (LSAD) protocols due to improper authentication level negotiation over Remote Procedure Call (RPC) channels. A MitM attacker who is able to able to intercept the traffic between a client and a server hosting a SAM database can exploit this flaw to force a downgrade of the authentication level, which allows the execution of arbitrary Samba network calls in the context of the intercepted user, such as viewing or modifying sensitive security data in the Active Directory (AD) database or disabling critical services. (CVE-2016-2118)

According to its banner, the version of Samba running on the remote host is 4.2.x prior to 4.2.11, 4.3.x prior to 4.3.8, or 4.4.x prior to 4.4.2. Therefore, it is affected by the following vulnerabilities :

 - A flaw exists in the DCE-RPC client that is triggered during the handling of specially crafted DCE-RPC packets. This may allow a remote attacker to conduct a MitM attack, downgrade a secure connection to an insecure one, cause a consumption of CPU resources, or potentially execute arbitrary code. (CVE-2015-5370)
 - A flaw exists in the implementation of NTLMSSP authentication that may allow a MitM attacker to conduct multiple attacks. This may allow the attacker to clear 'NTLMSSP_NEGOTIATE_SIGN' and 'NTLMSSP_NEGOTIATE_SEAL', take over connections, cause traffic to be sent without encryption, or potentially have other impacts. (CVE-2016-2110)
 - A flaw exists in NETLOGON that is due to the program failing to properly establish a secure channel connection. This may allow a remote MitM attacker to spoof a secure channel's endpoints' computer name and potentially obtain session information. (CVE-2016-2111)
 - A flaw exists that is due to a lack of integrity protection mechanisms. This may allow a remote MitM attacker to downgrade a secure LDAP connection to an insecure version of the connection. (CVE-2016-2112)
 - A flaw exists as TLS certificates are not properly validated for the LDAP and HTTP protocols. By spoofing the server via a certificate that appears valid, an attacker with the ability to intercept network traffic (e.g. MitM, DNS cache poisoning) can disclose and optionally manipulate transmitted data. (CVE-2016-2113)
 - A flaw exists that is due to the program failing to enforce the 'server signing = mandatory' option in 'smb.conf' for clients using the SMB1 protocol. This may result in SMB signing not being properly required, potentially allowing a MitM attacker to conduct spoofing attacks. (CVE-2016-2114)
 - A flaw exists that is due to the program failing to perform integrity checks for SMB client connections. As the protection mechanisms for DCERPC communication sessions are inherited from the underlying SMB connection, this may allow a MitM attacker to conduct spoofing attacks. (CVE-2016-2115)

The version of Samba on the remote host is 4.2.x prior to 4.2.10 and is affected by the following vulnerabilities :

 - A flaw exists in the DCE-RPC client when handling specially crafted DCE-RPC packets. A man-in-the-middle (MitM) attacker can exploit this to downgrade the connection security, cause a denial of service through resource exhaustion, or potentially execute arbitrary code. (CVE-2015-5370)
 - A flaw exists in the implementation of NTLMSSP authentication. A MitM attacker can exploit this to clear the NTLMSSP_NEGOTIATE_SIGN and NTLMSSP_NEGOTIATE_SEAL settings, take over the connections, cause traffic to be sent unencrypted, or have other unspecified impact. (CVE-2016-2110)
 - A flaw exists in NETLOGON due to a failure to properly establish a secure channel connection. A MitM attacker can exploit this to spoof the computer names of a secure channel's endpoints, potentially gaining session information. (CVE-2016-2111)
 - A flaw exists in the integrity protection mechanisms that allows a MitM attacker to downgrade a secure LDAP connection to an insecure version. (CVE-2016-2112)
 - A flaw exists due to improper validation of TLS certificates for the LDAP and HTTP protocols. A MitM attacker can exploit this, via a crafted certificate, to spoof a server, resulting in the disclosure or manipulation of the transmitted traffic. (CVE-2016-2113)
 - A flaw exists due to a failure to enforce the 'server signing = mandatory' option in smb.conf for clients using the SMB1 protocol. A MitM attacker can exploit this to conduct spoofing attacks. (CVE-2016-2114)
 - A flaw exists due to a failure to perform integrity checking for SMB client connections. A MitM attacker can exploit this to conduct spoofing attacks since the protection mechanisms for DCERPC communication sessions are inherited from the underlying SMB connection. (CVE-2016-2115)
  - A flaw, known as Badlock, exists in the Security Account Manager (SAM) and Local Security Authority (Domain Policy) (LSAD) protocols due to improper authentication level negotiation over Remote Procedure Call (RPC) channels. A MitM attacker who is able to able to intercept the traffic between a client and a server hosting a SAM database can exploit this flaw to force a downgrade of the authentication level, which allows the execution of arbitrary Samba network calls in the context of the intercepted user, such as viewing or modifying sensitive security data in the Active Directory (AD) database or disabling critical services. (CVE-2016-2118)

The version of Samba on the remote host is 4.4.x prior to 4.4.1 and is affected by the following vulnerabilities :

 - A flaw exists in the DCE-RPC client when handling specially crafted DCE-RPC packets. A man-in-the-middle (MitM) attacker can exploit this to downgrade the connection security, cause a denial of service through resource exhaustion, or potentially execute arbitrary code. (CVE-2015-5370)
 - A flaw exists in the implementation of NTLMSSP authentication. A MitM attacker can exploit this to clear the NTLMSSP_NEGOTIATE_SIGN and NTLMSSP_NEGOTIATE_SEAL settings, take over the connections, cause traffic to be sent unencrypted, or have other unspecified impact. (CVE-2016-2110)
 - A flaw exists in NETLOGON due to a failure to properly establish a secure channel connection. A MitM attacker can exploit this to spoof the computer names of a secure channel's endpoints, potentially gaining session information. (CVE-2016-2111)
 - A flaw exists in the integrity protection mechanisms that allows a MitM attacker to downgrade a secure LDAP connection to an insecure version. (CVE-2016-2112)
 - A flaw exists due to improper validation of TLS certificates for the LDAP and HTTP protocols. A MitM attacker can exploit this, via a crafted certificate, to spoof a server, resulting in the disclosure or manipulation of the transmitted traffic. (CVE-2016-2113)
 - A flaw exists due to a failure to enforce the 'server signing = mandatory' option in smb.conf for clients using the SMB1 protocol. A MitM attacker can exploit this to conduct spoofing attacks. (CVE-2016-2114)
 - A flaw exists due to a failure to perform integrity checking for SMB client connections. A MitM attacker can exploit this to conduct spoofing attacks since the protection mechanisms for DCERPC communication sessions are inherited from the underlying SMB connection. (CVE-2016-2115)
  - A flaw, known as Badlock, exists in the Security Account Manager (SAM) and Local Security Authority (Domain Policy) (LSAD) protocols due to improper authentication level negotiation over Remote Procedure Call (RPC) channels. A MitM attacker who is able to able to intercept the traffic between a client and a server hosting a SAM database can exploit this flaw to force a downgrade of the authentication level, which allows the execution of arbitrary Samba network calls in the context of the intercepted user, such as viewing or modifying sensitive security data in the Active Directory (AD) database or disabling critical services. (CVE-2016-2118)

The specific version of Samba that the system is running is reportedly affected by the following vulnerabilities:

- Samba contains a flaw in the DCE-RPC client that is triggered during the handling of specially crafted DCE-RPC packets. This may allow a remote attacker to conduct a man-in-the-middle attack, downgrade a secure connection to an insecure one, cause a consumption of CPU resources, or potentially execute arbitrary code. (CVE-2015-5370)

- Samba contains a flaw in its implementation of NTLMSSP authentication that may allow a man-in-the-middle attacker to conduct multiple attacks. This may allow the attacker to  clear NTLMSSP_NEGOTIATE_SIGN and NTLMSSP_NEGOTIATE_SEAL, take over connections, cause traffic to be sent without encryption, or potentially have other impacts. (CVE-2016-2110)

- Samba contains a flaw in NETLOGON that is due to the program failing to properly establish a secure channel connection. This may allow a remote man-in-the-middle attacker to spoof a secure channel's endpoints' computer name and potentially obtain session information. (CVE-2016-2111)

- Samba contains a flaw that is due to a lack of integrity protection mechanisms. This may allow a remote man-in-the-middle attacker to downgrade a secure LDAP connection to an insecure version of the connection. (CVE-2016-2112)

- Samba contains a flaw as TLS certificates are not properly validated for the LDAP and HTTP protocols. By spoofing the server via a certificate that appears valid, an attacker with the ability to intercept network traffic (e.g. MitM, DNS cache poisoning) can disclose and optionally manipulate transmitted data. (CVE-2016-2113)

- Samba contains a flaw that is due to the program failing to enforce the 'server signing = mandatory' option in smb.conf for clients using the SMB1 protocol. This may result in SMB signing not being properly required, potentially allowing a man-in-the-middle attacker to conduct spoofing attacks. (CVE-2016-2114)

- Samba contains a flaw that is due to the program failing to perform integrity checks for SMB client connections. As the protection mechanisms for DCERPC communication sessions are inherited from the underlying SMB connection, this may allow a man-in-the-middle attacker to conduct spoofing attacks. (CVE-2016-2115)

Versions of Samba prior to 4.2.10 / 4.2.11, 4.3.7 / 4.3.8 and 4.4.1 / 4.4.2 are unpatched for the badlock vulnerability.

ID	Name	Product	Family	Published	Updated	Severity
90534	SUSE SLED12 / SLES12 安全更新：samba (SUSE-SU-2016:1024-1) (Badlock)	Nessus	SuSE Local Security Checks	4/15/2016	1/6/2021	high
90609	openSUSE 安全更新：samba (openSUSE-2016-490) (Badlock)	Nessus	SuSE Local Security Checks	4/21/2016	1/19/2021	high
9232	Samba 4.3.x < 4.3.7 Multiple Vulnerabilities (Badlock)	Nessus Network Monitor	Samba	4/12/2016	3/6/2019	high
9822	Samba 4.2.x < 4.2.11 / 4.3.x < 4.3.8 / 4.4.x < 4.4.2 Multiple MitM	Nessus Network Monitor	Samba	12/9/2016	3/6/2019	medium
9231	Samba 4.2.x < 4.2.10 Multiple Vulnerabilities (Badlock)	Nessus Network Monitor	Samba	4/12/2016	3/6/2019	high
9233	Samba 4.4.x < 4.4.1 Multiple Vulnerabilities (Badlock)	Nessus Network Monitor	Samba	4/12/2016	3/6/2019	high
802024	Samba < 4.4.2, 4.3.8, 4.2.11, 3.6.26 Multiple Vulnerabilities	Log Correlation Engine	Samba	9/8/2016		critical
801967	Samba < 4.2.10/11, < 4.3.7/8, < 4.4.1/2 badlock Vulnerability	Log Correlation Engine	Samba	2/12/2016		high

Detections

Analytics

Plugins Search

high

high

high

medium

high

high

critical

high